Data protection information according to Art. 13 and 21 GDPR for the website of d.velop AG

1. General

We, the d.velop AG, take the protection of your personal data and the legal obligations that serve to ensure this protection very seriously. The legal provisions require comprehensive transparency in all issues regarding the processing of personal data. Only if the processing is traceable for you as the person concerned (data subject), you can be deemed to be sufficiently informed about the intention, purpose and scope of the processing. Our data protection declaration therefore explains to you in detail which so-called personal data is processed by us when you use the www.d-velop.de website or any other webpages that refer referring to it (see definitions below, 2.).

Controller in terms of the General Data Protection Regulation (GDPR), the Bundesdatenschutzgesetz – German Federal Data Protection Act (BDSG) as well as other data protection regulations isd.velop AGSchildarpstraße 6-8, 48712 Gescher, Germany+49 (0) 2542 9307-0info@d-velop.comwww.d-velop.dereferred to hereinafter as or „controller“ oder „we“.

Please note that links on our website may lead you to other webpages which are not operated by us but by third parties. Such links are either clearly identified by us or can be identified by a change in the address line of your browser. We are not responsible for compliance with the applicable data protection regulations and safe handling of your personal data on these third-party websites.

2. Definitions

2.1 According to the GDPR

2.2 Cookies

Cookies are text files that are stored or read by a website on your terminal device. They contain combinations of letters and numbers, e.g. to recognise the user and his settings when reconnecting to the cookie-setting website, to enable the user to remain logged in to a customer account or to statistically analyse a specific user behaviour.

3. General information about data processing

We only process personal data to the extent permitted by law. Disclosure or transfer to third parties takes place exclusively in the cases described below (see sec. 4 below).

Personal data will be deleted or protected by technical and organisational measures (e.g. pseudonymisation, encryption) as soon as the purpose of processing no longer applies. This will also occur a prescribed storage period expires, unless there is a need of further storage of personal data for the conclusion or performance of a contract.

Unless we are obliged by law to store personal data for a longer time or to pass it on to third parties (including but not limited to criminal prosecution authorities), the decision which personal data is collected by us, how long it is stored and to what extent you may have to disclose your data depends on which functions and features of the website you use in individual cases.

4. Data processing in connection with the use of the website

The use of the website and its functions and features regularly requires the processing of certain personal data.

4.1 Use of the website for information purposes

If you call up our website and use it for mere information purposes, e.g. without using additional functions or features such as contact forms or social media plugins, personal data is automatically collected. This involves the following information: Browser type and browser version, operating system used, address of the previously visited website, address of the terminal device with which you access the website (IP address) and time the website was called up. This information is transmitted by your browser unless you have configured it to suppress the transmission of the information.

The processing of this personal data is carried out for the purposes of functionality and optimisation of the website, as well as to ensure the security of our information technology systems. This is also our legitimate interest, which is why processing is permitted under Art. 6 subs. 1 f) GDPR.

The personal data is stored for a period of 14 days. We do not combine this personal data with other data sources. Data will only be disclosed or transferred to third parties if and to the extent this is necessary for operating our website. A transfer to a third country or to an international organization is not intended and will not take place, subject to further provisions of this data protection declaration. We cannot assign the data collected in the log files about access to the websites to a specific visitor of the websites.

4.2 Google Web Fonts

When you access our website, so-called Web Fonts are downloaded to ensure consistent look and feel of fonts. This content is provided by Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (“Google”). When you access our website, your browser loads the web fonts you need into your browser cache to display text and fonts correctly. For such purpose, the browser you are using must connect to Google´s servers. This will allow Google to know that your IP address has been used to access our website.

We use Google Web Fonts to ensure uniform and appealing presentation of our website. This is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR. Data transfer to the USA is made in accordance with the EU Commission Implementing Decision (EU) 2016/1250 (EU-U.S. Privacy Shield).

We collect your IP address to enable data transfer to Google. If your browser does not support Web Fonts or if you deactivate this function, no data will be transferred.

4.3 Google Maps

Parts of our website use Google Maps functions to integrate map data. This content is provided by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (“Google”). When you visit our website, your browser loads the necessary code from Google. For this purpose, the browser you are using must connect to Google’s servers. This gives Google knowledge that our website has been accessed via your IP address. At the same time, Google may place cookies on your terminal device unless you have prohibited the use of cookies in your browser or read cookies. Location data can also be collected if you allow this in your browser.

The use of Google Maps is for an appealing, comfortable design of our website and serves the purpose of making it easier to find us at the locations indicated on the websites. This is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR. Data transfer to the USA is made in accordance with the EU Commission Implementing Decision (EU) 2016/1250 (EU-U.S. Privacy Shield).

We collect your IP address to enable data transfer to Google. You are not obliged to provide this personal data; but it is not possible to use the affected parts of our website (contact and event pages) without providing it.

4.4 Social Media Plugin: YouTube

Parts of our website use the services provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”) to display video contents. When you access the corresponding pages, your browser loads the YouTube code required to display the video. For this purpose, the browser you are using must connect to YouTube`s servers. This enables YouTube to know that our website has been accessed via your IP address. At the same time, YouTube may place cookies on your terminal device unless you have prohibited the use of cookies in your browser or read cookies.

We use the YouTube plug-in to ensure an appealing design for our website and to enable the display of video content. This is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR. Data transfer to the USA is made in accordance with the EU Commission Implementing Decision (EU) 2016/1250 (EU-U.S. Privacy Shield).

We collect your IP address to enable data transfer to YouTube. You are not obliged to provide this personal data; but you will not be able to use the affected parts of our website without providing it.

4.5 Google Analytics

We use Google Analytics for the purposes of economic optimisation and to tailor our website to suit the customers’ demands. This is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR. In addition, we have concluded a contract with Google for data processing on behalf and we fully implement and comply with the strict requirements of the German data protection authorities when we use Google Analytics. Data transfer to the USA takes place in accordance with the EU Commission Implementing Decision (EU) 2016/1250 (EU-U.S. Privacy Shield).

We collect your IP address to enable the shortening and subsequent data transfer to Google in the USA. You are not obliged to provide this personal data; use of our website is possible without such provision. You can prevent the provision of this personal data by installing the Add-on under https://tools.google.com/dlpage/gaoptout?hl=de.

4.6. Google Adwords Conversion Tracking

Google AdWords places a cookie (see 2.2) on your computer when you visit our website via a Google advertisement. These cookies expire after 30 days and are not used for personal identification. If the User visits certain pages of the AdWords customer’s website and the cookie has not expired, Google and the Customer will be able to recognize that the User clicked on the ad and was directed to tats page. Each AdWords customer receives a different cookie. Cookies cannot be tracked through the websites of AdWords customers. The information collected using the conversion cookie is used to generate conversion statistics for AdWords customers who have opted for conversion tracking. AdWords customers will know the total number of users who clicked on their ad and were directed to a page with a conversion tracking tag. However, you will not receive any information that personally identifies users.

Google Conversion Tracking is used for the purposes of economic optimisation, tailoring our website to your need and the correctly billing of advertising campaigns that we run. This constitutes a legitimate interest within the meaning of Art. 6 subs. 1 f) GDPR. The data transmission to Google in the USA is in accordance with the EU Commission’s implementing decision (EU) 2016/1250 (EU-US data protection shield).

If you do not wish to participate in the tracking procedure, you can also refuse to set a cookie as required for this purpose – for example by using a browser setting that generally deactivates the automatic setting of cookies. You can also deactivate cookies for conversion tracking by setting your browser to block cookies from the domain “www.googleadservices.com”. Google’s privacy policy on conversion tracking can be found here(https://services.google.com/sitestats/de.html).

4.7 Matomo

When you visit our website, a plugin called Matomo of the Innocraft Ltd. 150 Willis St, 6011 Wellington, New Zealand (“Matomo”) is loaded for statistical evaluation of the use of the website. Matomo is a plug-in which is operated on our server. Matomo uses cookies which are stored on your terminal device unless you have forbidden the use of cookies in your browser settings and which allow an analysis of the use of the website by you.

We use the Matomo plug-in for the purposes of economic optimisation and the need-based design of our website. This represents a legitimate interest within the meaning of Art. 6 subs. 1 f) GDPR.

Your IP address will be anonymised by us immediately after the collection by replacing parts of the IP address with following characters (“x”) during storage (so-called “IP masking”). After that, your IP address can no longer be allocated to you. A data transfer to third parties does not take place. You are not obliged to provide this personal data; a use of our website is possible without the provision. If you remove the following check mark, Matomo will not collect further information about how you use the website.

4.8 HubSpot

We use the inbound marketing tool “HubSpot” on our website, which is provided by HubSpot Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141 USA. HubSpot is a web-based all-in-one marketing software that serves the realisation and control of inbound marketing. It helps us to arouse your interest in our products. The central element of HubSpot are the user-related personal profiles. A personal contact within HubSpot is created as soon as a previously anonymous website visitor fills out a HubSpot form. At this moment, a contact will be created based on your e-mail address. You will only be contacted if you explicitly confirm that you wish to be contacted.

HubSpot is used for the purposes of individualising advertising and market research. These constitute a legitimate interest within the meaning of Art. 6 subs. 1 f) GDPR. In addition, we have concluded an order processing agreement with HubSpot and fully implement the strict requirements of the German data protection authorities when using HubSpot. Data transmission to the USA is in accordance with the EU Commission’s implementing decision (EU) 2016/1250 (EU-US data protection shield).

4.9 Contact form / contact by e-mail / call back request /Live-Chat

If you use a contact form on our website, send us an e-mail, use the live chat or request a call back via the form, the personal data you enter there will first be processed for us by HubSpot as a marketing service provider and then made available to us for further processing. This information is transmitted by your browser or e-mail client and stored in our information technology systems. The processing of this personal data is necessary to answer your enquiry. In addition, your IP address and the date and time of the contact request are stored.

Data processing serves to answer your inquiry and to prevent misuse of the contact form and to guarantee the security of our information technology systems. These processing operations are lawful because the response to your inquiry and the protection of our information technology systems represent legitimate interests within the meaning of Art. 6 subs. 1 f) GDPR.

Personal data will be stored for as long as is necessary to answer your enquiry. Should your request lead to a later conclusion of contract, it will be stored as long as this is necessary to carry out pre-contractual measures or to fulfil the contract. We do not merge this personal data with other data sources. Data will not be passed on to third parties. A transfer to a third country or to an international organisation is not intended. You are not obliged to provide this personal data, but it is not possible to use the contact form or send an e-mail without providing it.

4.10 Opening and using a customer account

You can create a customer account on our website. If you do this, the personal data you enter there will be transmitted to us by your browser and stored in our information technology systems. Your IP address and the time of registration are also stored. When you log into your customer account, our website places cookies on your terminal device to enable you to remain logged in, even if you have to reload the website in the meantime. You also have the possibility to use our online support offer with integrated ticket system by logging in with your user account data. Furthermore you can use our d.velop service portal and our community “d.velop usergroup” via your customer account.

The processing of the personal data entered by you serves the purpose of being able to assign future usage processes such as orders or contact requests to your customer account.

This processing is legal because you have given us your consent in accordance with Art. 6 subs. 1 a) GDPR. In addition, the opening of a customer account is a prerequisite for placing an order in our online shop, and processing is also required for fulfilling the contract pursuant to Art. 6 subs. 1 b) GDPR. The storage of IP address and time of registration is necessary to guarantee the security of our information technology systems. This is also our legitimate interest, which is why processing is permitted under Art. 6 subs. 1 f) GDPR.

The personal data entered by you will be stored until your customer account with us is terminated, but in any case, as long as necessary to fulfil the contract. IP address and time of registration are stored for a period of 14 days. The cookies lose their validity when you log out. We do not merge this personal data with other data sources. Data will not be passed on to third parties.

4.11 Onlineshop

Our website provides an online shop. The creation of a customer account (see 4.10. for details) is a prerequisite for placing an order in our online shop. If you add products to your shopping cart, our website places cookies on your terminal device to enable you to continue the order even if you have to reload the website in the meantime. When you place an order, the personal data entered in the order form is also transmitted to us by your browser and stored in our information technology systems. In addition, your IP address and time of the order are stored.

The processing of the personal data entered by you serves the purpose of being able to deliver an order. This processing is lawful because it is necessary to fulfil the contract in accordance with Art. 6 subs. 1 b) GDPR.

The storage of IP address and time of the order serves the purpose of ensuring the security of our information technology systems. This is also our legitimate interest, which is why processing is permitted under Art. 6 subs. 1 f) GDPR.

The personal data entered by you will be stored for as long as is necessary to fulfil the contract. IP address and time of the order are stored for a period of 14 days. We do not combine this personal data with other data sources. Data will only be passed on to third parties if this is necessary to fulfil the contract (e.g. to payment service providers etc.). A transfer to a third country or to an international organisation is not intended. You are not obliged to provide this personal data, but an order in our online shop is not possible without the provision.

4.12 Subscription to a newsletter

You can subscribe to our newsletter on our website. If you do so, the personal data you provide when registering will be transmitted by your browser to HubSpot, our marketing service provider, which also supports us in the context of subscribing and sending newsletters and stored in its information technology systems. Your IP address and the time of registration are also stored. We have access to and can process the information and personal data stored at HubSpot with regard to subscriptions and the sending of newsletters.

The processing of the personal data entered by you serves to send the newsletter. This processing is legal because you have given us your consent in accordance with Art. 6 subs. 1 a) GDPR. The storage of IP address and time of registration serves the purpose of ensuring the security of our information technology systems. This is also our legitimate interest, which is why processing is permitted under Art. 6 subs. 1 f) GDPR.

The personal data you enter will be stored until your subscription with us is cancelled. We do not merge this personal data with other data sources. Data will not be passed on to third parties. A transfer to a third country or to an international organisation is not intended. You are not obliged to provide this personal data, but subscription to our newsletter is not possible without such provision.

On our website you can request information on certain products, have guides sent to you or register for free trial versions of our software solutions. If you do so, the personal data you provide when making the request will be transmitted by your browser to us or to HubSpot, our marketing service provider, and stored in the respective information technology systems. If you are already a customer of ours, you only need to enter your customer number and your e-mail address; we will then use the personal data from your customer account (see 4.10. for more details). Your IP address and the time of your request will also be stored.

The processing of the personal data entered by you serves the purpose of the preparation and dispatch of the individual offer or the dispatch of the advertising material or the dispatch of information and access data. This processing is lawful because it is necessary for the implementation of pre-contractual measures pursuant to Art. 6 subs. 1 b) GDPR and the response to your enquiry is a legitimate interest of ours pursuant to Art. 6 subs. 1 f) GDPR. The storage of IP address and time of the request serves the purpose of ensuring the security of our information technology systems. This is also our legitimate interest, which is why processing is permitted under Art. 6 subs. 1 f) GDPR.

The personal data provided by you will be stored for as long as it is necessary to dispatch the advertising material or to prepare an offer or, should a contract be concluded, to fulfil the contract. We do not combine this personal data with other data sources.

4.14 Registration for training courses/seminars/webinars and other events

You can register on our website for training courses, seminars, webinars and other events carried out by us. If you do this, the personal data you provide when registering will be transmitted to us or to our marketing service provider HubSpot via your browser and stored in the respective information technology systems. If you are already a customer of ours, it is sufficient to enter your customer number and your e-mail address; we will then use the personal data from your customer account (see 4.10. for more details). Your IP address and time of registration will also be stored. When you register for a webinar, the personal information you provide during registration is transferred through your browser to HubSpot and from there to GoToWebinar, LogmeIn Ireland Limited, Bloodstone Building Block C, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (“GoToWebinar”). For information about GoToWebinar’s privacy policy, please visit https://www.logmeininc.com/de/legal/privacy.

The processing of the personal data entered by you serves the purpose of preparing and holding the seminar in which you would like to participate. This processing is lawful because it is necessary to fulfil the contract in accordance with Art. 6 subs. 1 b) GDPR. The storage of IP address and time of registration serves the purpose of ensuring the security of our information technology systems. This is also our legitimate interest, which is why processing is permitted under Art. 6 subs. 1 f) GDPR.

The personal data provided by you will be stored until after the seminar has been held. We do not combine this personal data with other data sources. Data will only be passed on if this is necessary to conduct the seminar (e.g. to cooperation partners who provide the premises, but in particular also to HubSpot and GoToWebinar). A transfer to a third country or to an international organization is not intended. You are not obliged to provide this personal data, but registration for seminars is not possible without such provision.

4.15 Blog with comment feature

You can comment on a blog entry on our website. If you do this by clicking on the “Send comment” button, the personal data you enter (name and e-mail address) will be transmitted to us by your browser and stored in our information technology systems. Your IP address and the time when the comment was sent will also be saved.

The processing of the personal data entered by you serves the purpose of displaying your comment on our website. This processing represents a legitimate interest within the meaning of Art. 6 subs. 1 f) GDPR in order to verify the origin of the comment. The storage of the IP address and the time of the submission of the comment serves to guarantee the security of our information technology systems. This also constitutes a legitimate interest pursuant to Art. 6 subs. 1 f) GDPR.

The personal data you enter will be stored for as long as is necessary to display the comment. We do not merge this personal data with other data sources. Data will not be passed on to third parties. A transfer to a third country or to an international organisation is not intended. You are not obliged to provide this personal data, but it is not possible to submit a comment without it.

4.16 Career portal: Use of the application form

You have the possibility to send us an application online via our application form. In the course of your online application, we will collect and process your personal data for the purpose of carrying out the application process. Only the data you provide us with in connection with your application will be stored (in particular master data; communication data; insofar as you provide us with such data: certificates, additional qualifications, curriculum vitae, salary requirements, earliest possible starting date, any news and content regarding documents uploaded by you). As soon as the form is sent, the information will be forwarded to the HR department. If you expressly agree to it, the processing will also be carried out for consideration in future application procedures of d.velop or its subsidiaries that match your application.

The legal basis for the implementation of the application procedure is Art. 88 subs. 1 GDPR in conjunction with § 26 subs. 1 sentence 1 BDSG, for applications to subsidiaries and for storage for future application procedures Art. 6 subs. 1 a) GDPR in conjunction with Art. 7 GDPR, § 26 subs. 2 BDSG. Your data will not be passed on. Only if you expressly agree to this will d.velop pass on your data to subsidiaries of d.velop for current and possibly future application procedures.

d.velop stores your data until the end of the application process. Three months later the data of unsuccessful applications will be deleted. This also applies if you revoke your consent. If you expressly agree to this, d.velop will store your data for up to two years, after which the data will be deleted if the application was not successful. This also applies if you revoke your consent. If the data is passed on to subsidiaries of d.velop with your consent, the respective storage period also applies to these subsidiaries. Your personal data will not be transferred to a third country or to an international organization.

4.17 LinkedIn Insight Tag

We use on our website a service (“LinkedIn Conversion-Tracking”) of the LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). The LinkedIn “Insight Tag” is used to support the service.

LinkedIn Conversion Tracking allows us to measure the effectiveness of our advertisements. Each time a page containing LinkedIn features is accessed, a connection is established to LinkedIn’s servers. LinkedIn will be informed that you have visited our website. At the same time, LinkedIn may store or read cookies on your device unless you have prohibited the use of cookies in your browser. In particular, the LinkedIn Insight tag enables us to analyse the success of our campaigns within LinkedIn or to determine target groups for these campaigns based on user interaction with our online offering. If you are registered with LinkedIn, LinkedIn will be able to associate your interaction with our online services with your user account.

The LinkedIn Insight tag allows us to collect information about member visits to our site, including URL, referrer URL, IP address, device and browser properties (user agent), and timestamp. This information is deleted within seven days.

LinkedIn does not share this personally identifiable information with us, but only provides aggregated reports about the website’s target audience and ad performance.

Data processing serves to display personalised advertising and enables us to evaluate the use of our website. This is a legitimate interest pursuant to Art. 6 Para. 1 Letter f GDPR.

You can prevent the storage and reading of cookies by making the appropriate settings in your browser software. You can also prevent LinkedIn from collecting the data generated by the cookie and related to your use of the website and from processing this data by LinkedIn by setting an opt-out cookie that prevents your data from being collected in the future when you visit this website. To do this, click on this link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

4.18 Facebook-Ads – Custom Audiences

We use the remarketing function “Custom Audiences” of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). Custom Audiences allows us to target users of our Web site with targeted advertising by placing personalized and interest-based Facebook ads (https://de-de.facebook.com/business/products/ads) on them when they visit the Facebook social network.

We use Facebook Custom Audiences in the “Facebook Custom Audiences from Website” variant (Facebook Pixel). An invisible pixel is included on our website. When a potential customer views certain products on our website, adds them to the shopping cart, and may cancel an order, that invisible pixel transmits the information to Facebook. The next time the potential customer logs in to Facebook, the integration of the pixel allows the potential customer to receive targeted advertising for the product that he or she had previously viewed but may not have purchased.

This personal data is processed for the purpose of optimizing our offers and individualized advertising. This is also our legitimate interest, which is why processing is permitted under Art. 6 Para. 1 Letter f GDPR. Data is transferred to the USA in accordance with the implementing resolution (EU) 2016/1250 of the EU Commission (EU-US Data Protection Shield). If you do not want Facebook to assign the collected information directly to your Facebook user account, you can deactivate the remarketing function “Custom Audiences” in the settings of your Facebook user account. You must be logged in to Facebook to do this. Alternatively, you can click on the “Deactivate Facebook Pixel” button below, which sets a cookie that prevents data transfer to Facebook.

For more information about Facebook’s collection and use of data, your rights in this regard, and how Facebook can protect your privacy, please see Facebook’s Privacy Notice (https://www.facebook.com/about/privacy/).

5. Rights of data subjects

You as the person concerned (hereinafter “data subject”) have the right to information pursuant to Art. 15 GDPR, the right to correction according to Art. 16 GDPR, the right to erasure according to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR as well as the right to data portability according to Art. 20 GDPR. The right to information as well as the right to erasure are subject to the restrictions under §§ 34, 35 BDSG (German Federal Data Protection Act). In addition, there is a right of appeal to a data protection supervisory authority (Art. 77 GDPR in combination with § 19 BDSG).

6. Automated case-by-case decisions including profiling

No automated case-by-case decisions are taken, including profiling.

7. Controller’s duty to inform

We will inform all recipients to whom your personal data was disclosed of any rectification or erasure of your personal data or any restriction of processing according to Art. 16, Art. 17 subs. 1 and Art. 18 GDPR unless such notification is impossible or involves disproportionate effort.We will inform you about the identity of the recipients at your request.

8. Right of objection

You have the right, for reasons arising from your situation, to object at any time to the processing of your personal data based on Art. 6 subs. 1 e) or f) GDPR; this also applies to profiling based on these provisions. If personal data are processed for direct marketing, you have the right to object any time to the processing of your personal data for such direct marketing purposes; this also applies to profiling insofar as it relates to such direct marketing. The objection can be made without form and is to be addressed to:d.velop AGSchildarpstraße 6-848712 Gescher, Germanyinfo@d-velop.com

9. Right to withdraw your consent to personal data processing

Pursuant to Art. 7 subs. 3 sentence 4 GDPR, you have the right to withdraw your consent at any time. This does not affect the legality of the processing carried out based on the consent up to the withdrawal. Thus, the withdrawal only applies to the processing planned after the withdrawal. The withdrawal can be made informally, by posted letter or email. If you revoke your consent and there is no other basis for permission, the personal data must be deleted immediately at your request under Art. 17 subs. 2 b) GDPR.The withdrawal can be made without form and is to be addressed to:d.velop AGSchildarpstraße 6-848712 Gescher, Germanyinfo@d-velop.com